That distinction matters. FINTRAC's own penalty guidance treats a missed, overdue, or superficial effectiveness review as a serious violation, with penalties up to $100,000 under the AMP policy that applies to violations committed entirely before 26 March 2026; violations on or after that date fall under the amended PCMLTFA maxima, and FINTRAC is still updating its implementing guidance. Two 2025 enforcement notices show entities fined specifically for failing this requirement. FINTRAC's compliance program requirements make clear the review must test effectiveness, not just confirm paperwork exists.
Treating the review as a formality (hire someone, get a signed report, file it away) misses the point. This article explains what FINTRAC's effectiveness review requires under Canadian rules, who qualifies to perform one, what it needs to cover, and how to get real value from it.
Key Takeaways
- An AML effectiveness review is mandatory at least every two years under PCMLTFR s. 156(3)
- "Independent" refers to organizational separation from day-to-day program operation; "external" is a delivery model, not a mandatory equivalent of independence
- A real review tests operating effectiveness, not just whether policies exist on paper
- Findings can inform how your program is viewed during an examination
- Overdue or superficial reviews can themselves be treated as serious compliance gaps
What Do "Independent" and "External" Mean in Practice?
These two words get used interchangeably. They should not be. Neither word replaces the legal requirement: an effectiveness review.
External means outside the organization.
Independent / impartial (best practice and FINTRAC guidance language) means more than that: no role in designing, implementing, or operating the program under review, and no conflict of interest, reporting line, or operational stake in the outcome. Impartial challenge is a best practice and an AlphaDelta service model; it is not a universal statutory requirement that every reviewer must be external.
A person can be external but not impartial. A consultant who helped write your policies last year is a clear example. Someone can also be internal and still structurally separate if they sit outside the compliance function's chain of command.
Who Actually Qualifies
FINTRAC's guidance permits the review to be carried out by an internal auditor, an external auditor, or the reporting entity itself if no auditor exists. FINTRAC's best-practice language is that the review should not be conducted by someone directly involved in compliance-program activities.
In practice, this means:
- Internal audit can qualify where genuine structural separation from day-to-day program development and maintenance exists
- Third-party AML specialists are a common way to obtain impartial challenge
- The reporting entity itself may conduct the review if no auditor is available
- FINTRAC does not require a CPA, CAMS, or law degree, but does expect relevant AML/ATF expertise
A reviewer with no regulatory-lifecycle experience can still produce a report that looks complete on paper without testing whether the program works under examination pressure. That is a quality risk, not proof that only external reviewers are lawful.
Why FINTRAC Requires This Review, and What Triggers It
The requirement isn't optional guidance dressed up as policy. It's law.
PCMLTFA s. 9.6(1.1) requires every compliance program to be reasonably designed, risk-based, and effective. PCMLTFR s. 156(1)(f) requires a documented plan to test that effectiveness.
Section 156(3) sets the cadence: every two years, starting no later than 24 months from the previous review's start date, with the prior review completed before the next one begins. FINTRAC's compliance program guidance confirms these timing mechanics.
This applies broadly across FINTRAC reporting entities, including:
- Banks and credit unions
- MSBs and securities dealers
- Casinos, real estate brokers, and mortgage lenders
- Life insurers and dealers in precious metals
If you report to FINTRAC, this requirement applies to you.
What Happens If You're Late or Superficial
Failing to carry out and document the effectiveness review is a compliance-program contravention under PCMLTFA s. 9.6(1) and PCMLTFR s. 156. FINTRAC's published harm-assessment guide (last modified 2019-08-26) still cites former PCMLTFR s. 71(1)(e) and a serious-violation range of $1–$100,000; readers should confirm current AMP classification and maxima, including the March 2026 PCMLTFA amendments. The review may be conducted by an internal or external auditor, or by the entity itself if it has no auditor (PCMLTFR s. 156(3)). Impartiality is a FINTRAC best practice, not a universal legal requirement that every reviewer be an external qualifying auditor.
Two recent enforcement examples make this concrete:
| Entity | Sector | Penalty | Review-Related Finding |
|---|---|---|---|
| A dealer in precious metals and stones | Precious metals dealer | $132,000 | Failed to institute and document the prescribed effectiveness review |
| An accounting firm | Accounting firm | $72,750 | Failed to conduct/document the biennial review |
Both cases closed in 2025. Both entities paid in full.
A scheduled effectiveness review runs on the two-year statutory clock (PCMLTFR s.156). Material changes (significant findings, a major program change, a new business line, or a leadership transition) may warrant updating the risk assessment and controls, or commissioning an additional review, as sound practice. Those events do not universally create a separate early statutory effectiveness-review trigger outside the two-year cycle.
What a Proper Effectiveness Review Must Assess
A review that stops at "does a policy exist" is not doing its job. FINTRAC guidance points to two distinct tests:
- Design effectiveness — is the program appropriately built for this entity's risk profile, products, customers, and delivery channels?
- Operating effectiveness — does the program actually function that way day-to-day, not just on paper?
Core Components Reviewers Should Test
- Risk assessment methodology: written rationales, coverage of all business aspects, high-risk measures matched to actual controls
- Policies and procedures: completeness, documentation, and evidence they're followed in practice
- Training: role-tailored content, delivery tracking, and evidence employees actually understand it
- Transaction monitoring: frequency, risk-based escalation, and whether inconsistent activity gets flagged and addressed
- Compliance officer effectiveness: authority, knowledge, and whether the role functions as designed
A proper review locks this scope before fieldwork starts. The review plan should document scope, criteria, review period, and a testing approach matched to the entity's obligations and risk profile.
At AlphaDelta, methods typically include document review, interviews, walkthroughs, file sampling, and end-to-end testing to confirm controls work in practice.
Documenting Findings So They're Actionable
A review report that buries findings in vague language helps no one. Credible reports distinguish between:
- Technical gaps (a form field missing, a training module outdated)
- Structural or governance weaknesses (unclear authority, no board reporting line)
Each type needs a different remediation path. Treating them the same sends management after the wrong fix.
Common Gaps Found in AML Effectiveness Reviews
Reviewers and law firms tracking FINTRAC's examination patterns often flag problem areas such as the following.
Stale risk assessments. Programs get built once and rarely revisited as products, customer bases, or delivery channels expand. McCarthy Tetrault's analysis of common FINTRAC deficiencies identifies outdated risk-coverage frameworks as a recurring issue. The assessment simply hasn't kept pace with the business.
Generic training. Training that treats every employee the same way, regardless of role or risk exposure, does not meet FINTRAC's expectations. A teller and a compliance analyst face different risks; their training should reflect that.
Monitoring never validated against risk. Transaction monitoring rules and thresholds get set once, often at implementation, and never checked against how the entity's actual risk profile has evolved. Alerts then miss real risk while flooding compliance teams with noise on lower-risk activity.
None of these show up clearly unless someone actually tests operating effectiveness, rather than confirming a document exists.
How to Prepare for and Get Value From the Review
Before the engagement starts:
- Compile current program documentation, prior review reports, and any past examination or audit findings
- Identify material changes since the last review: new products, new customer segments, leadership changes
- Bring executive leadership in early, so findings translate into governance decisions rather than sitting as a to-do list for the compliance team alone
A review's value evaporates if findings stop at the compliance officer's desk. Boards and senior management need documented findings so they can make resourcing and governance decisions, not just nod at a summary slide.
AlphaDelta frames findings as evidence-based independent challenge grounded in regulatory-lifecycle experience, not as guarantees of examination outcomes.
Each review also includes practical support after delivery:
- Every engagement includes one optional findings clarification session within 90 days of the final report.
- If FINTRAC formally initiates a compliance examination within 12 months of the final report, AlphaDelta will provide up to 10 hours of review-related senior advisory support at no additional cost.
Choosing the Right Independent Reviewer
Not all reviewers bring the same value, even if they check the same procedural boxes.
What actually matters:
- Direct regulatory-lifecycle experience: building programs, defending them in examinations, or having conducted examinations as a regulator
- Genuine independence, confirmed in writing, with conflicts assessed and documented
- Relevant AML/ATF expertise, not just generic audit or consulting credentials
A reviewer who has only ever written reports, never sat across from a FINTRAC examiner, and never built a program that had to operate under examination tends to produce findings that read well but miss what a regulator will actually push on.
Many law firms and specialist advisory partners supporting AML clients recognize this gap. Rather than building the capability in-house, they bring in a senior specialist for these engagements. AlphaDelta operates as that kind of platform. It extends senior AML expertise built through roles including IIROC/CIRO examiner and enterprise AML program owner to multiple Canadian reporting entities.
Frequently Asked Questions
How often does a Canadian reporting entity need an AML effectiveness review?
Every two years, per PCMLTFR s. 156(3), starting no later than 24 months after the previous review began. Confirm your sector's specific expectations, since FINTRAC's examination focus can vary by entity type. The legal requirement is the effectiveness review cadence; "independent external review" is not the statutory name.
Can an internal employee conduct the effectiveness review?
Yes. FINTRAC permits an internal auditor, an external auditor, or the reporting entity itself if no auditor exists. Best practice is an impartial reviewer not directly involved in developing or maintaining the program. Lack of internal separation does not automatically create a legal duty to hire an external party; it is a practical reason many entities choose external challenge.
What happens if a reporting entity's review is overdue?
An overdue review is itself a compliance gap. FINTRAC's penalty guidance treats this as a serious violation that can trigger administrative monetary penalties during an examination.
What's the difference between an internal audit and an effectiveness review?
Internal audit typically covers broader operational risk across the organization. An AML effectiveness review specifically tests AML program design and operating effectiveness, and reports findings to a senior officer for regulatory purposes. Internal audit can perform the effectiveness review where structural separation exists.
Who should receive the findings from an AML effectiveness review?
A senior officer, as required under the PCMLTFR for written reporting of effectiveness-review findings. Findings should reach decision-makers who can act on them at a governance level, not just the compliance team. Universal board approval of review scope, budget, or risk matrix is not a FINTRAC prescription.
Does a clean review result mean the program is FINTRAC-ready?
No. A favourable review reduces risk but doesn't guarantee examination outcomes. Regulatory posture depends on how the program continues operating after the review, not just its condition on review day.
